Deloitte AI Assist for Customer vulnerabilities

Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the RAG corpus. On 2026-03-25, network access was restricted and authentication was enforced for the previously exposed endpoints.

Deloitte AI Assist for Customer accepted unauthenticated POST requests through public API endpoints, allowing a remote attacker to make limited configuration changes. These changes were not used by the system. Since 2026-03-25, network access has been restricted and authentication enforced.

Deloitte AI Assist for Customer exposed configuration information through public API endpoints that accepted unauthenticated requests. This information could reduce an attacker's reconnaissance effort. As of 2026-03-25, network access was restricted and authentication enforced.